Case Study · Product

Config365

PotSolutions fully designed and built Config365 — an open-source GitOps orchestration platform for Microsoft 365, now available in public preview. Deploy tenant configs, detect drift, enforce compliance, and manage unlimited clients from a single self-hosted container with a full management portal.

PotSolutions Product Public Preview Microsoft 365 GitOps Open Source Multi-Tenant MSP

The Challenge

M365 at Scale Is Still Manual

MSPs and internal IT teams managing multiple Microsoft 365 tenants face the same operational pain: PowerShell scripts on laptops, configuration drift between clients, no audit trail, and risky one-click applies with no preview.

Conditional Access, Intune policies, Defender settings, sensitivity labels, groups, and app registrations each live in different admin surfaces. A shared baseline that works across tenants breaks the moment group IDs differ. Client-specific exceptions get overwritten on the next deploy. Backups are ad hoc — if they exist at all.

PotSolutions set out to build a purpose-built system: define everything as JSON in Git, preview every change before it lands, require human approval, back up automatically, and run it all from a browser — without third-party SaaS touching tenant credentials.

The Solution

GitOps for Microsoft 365

Config365 treats M365 tenant configuration like infrastructure-as-code — versioned, reviewable, and repeatable across every client you manage.

Core deployment loop

WhatIf preview — every run starts with a mandatory diff showing exactly what will be created, updated, or deleted.
Approval gate — a human reviews the WhatIf report in the portal; no change reaches a tenant without sign-off.
Apply — Microsoft Graph, Exchange, Security & Compliance, and SharePoint PowerShell deploy groups, policies, Intune configs, sensitivity labels, Teams settings, and more — with detailed per-item feedback.
Automated backup — the full tenant configuration is exported to Git immediately after deploy, and again nightly at 2 AM UTC.

Git repository (baseline JSON + per-tenant assignments) │ ▼ Gitea Actions — trigger pipeline run │ ▼ WhatIf — diff against live tenant (create / update / delete) │ ▼ Approval gate — review in CONFIG365 portal │ ▼ Apply — Graph + EXO + SCC + SPO PowerShell │ ▼ Backup — export full tenant config → commit to Git Groups first: {{GROUP:name}} templates resolve to IDs at deploy time Protection: CONFIG365:IGNORE on resources · .baseline-ignore per tenant Runtime: single OCI container — portal + Gitea + runner bundled

What We Built

Platform & Portal

PotSolutions delivered the full stack — deployment engine, Git integration, management portal, and enterprise baseline — as a single self-hosted product.

Management portal

Tenant dashboard — multi-tenant overview with pipeline status, last backup time, and one-click deploy or approve.
WhatIf viewer — review every create, update, and delete before it applies; approve or reject with full diff visibility.
Policy & baseline viewer — browse backed-up tenant config, compare against the shared baseline, and promote changes.
Timeline — full deployment history with per-commit diffs; restore any resource to a previous state from the UI.
App deployment — Win32 apps from Chocolatey or WinGet, mobile apps via Intune, and Enterprise App registrations — all from JSON in Git.
Maintenance tasks — scheduled operations: group splits, Exchange font defaults, GAL visibility, Intune device renaming.

Built for MSPs

One baseline repository, deploy to unlimited tenants with separate assignments per client.
GCC High support — same workflows and baselines, pointed at Government Cloud endpoints.
Per-client flexibility — .baseline-ignore opts specific policies out without touching the shared baseline.
Resource protection — any M365 resource tagged CONFIG365:IGNORE is skipped on deploy.
Baseline policy groups — segment baseline files and restrict deployment to member tenants only.
No local tools — MSP staff need only a browser; no PowerShell modules or local setup.

Enterprise baseline included

A complete, opinionated M365 configuration ships with Config365 — Conditional Access, Intune, Defender, identity policies, and more. Phish-resistant and Zero Trust out of the box. The same baseline powers PotSolutions’ own Modern Workplace & Enterprise Security engagements and customer deployments at scale.

Technology

What We Used

Platform

Microsoft Graph API Exchange Online PowerShell Security & Compliance Center SharePoint Online Microsoft Intune Entra ID Microsoft Defender

Product & DevOps

Gitea + Gitea Actions GitOps / JSON-as-config OCI container Azure Container Apps Azure App Service Self-hosted GCC High Open Source

The Result

Now in Public Preview

Config365 is publicly available in preview at config365.io — already powering real MSP and enterprise M365 deployments designed and built entirely by PotSolutions.

100%
Developed by PotSolutions
1
Container — portal + Git + runner
∞
Tenants per instance
Daily
Automated Git backups

Every M365 change previewed, approved, applied, and backed up — with a full audit trail in Git history

One shared baseline deploys consistently across unlimited tenants — with per-client opt-outs and assignments

Minimal attack surface — self-hosted container; no third-party SaaS ever touches tenant credentials

Full management portal — tenants, deployments, diffs, backups, and maintenance from the browser

Clear per-policy feedback — know exactly what changed, what failed, and why; no cryptic DSC errors

Point-in-time restore from nightly backups — roll back any resource to any date in Git history

Explore Config365

Open Source M365 Orchestration

Config365 is live in public preview. Try it at config365.io, or talk to PotSolutions about managed M365 baselines and deployments powered by the platform we built.

Try Config365 at config365.io Talk to PotSolutions